oidc or remote authentication support

[rophy]

Hi, does snapp supports OIDC or remote authentication?

Remote authentication means snapp can assume a reverse proxy which handles user authentication, and determine authenticated username based on a defined header such as X-Remote-User.

[urania-dev]

Hello, no unfortunately it does not. And is not going to atm.

The app rely on Lucia auth with user/password auth. It could be easily implemented with a fork of the project maybe, but im try to add less features but in a more stable and controller manner.

[IvanLi-CN]

I apologize for commenting on a closed issue, but I'm particularly hopeful that snapp could integrate OIDC.

I've self-hosted many applications and use Authelia as an SSO solution. It's incredibly convenient not having to log in separately for each application.

I took a brief look at Lucia and it seems they offer integration options for OAuth 2.0 and OIDC: https://v2.lucia-auth.com/oauth/

If integration through Lucia is possible, would you be open to accepting a PR for OIDC support? I'm considering implementing this feature for my own use, but it would be great if it could be merged into the main repository.

Since I'm a bit busy, I haven't had the chance to dive deep into Lucia yet. So I'd like to hear your thoughts on this first.

[urania-dev]

actually we use lucia3, and lucia next is gonna be a manual instead of an actual library. so i think that yeah, it is possible, i just have to learn how to.

Edit: I re-read your message and just understood that you were offering to work on it, feel free, i'm trying to understand it better myself, we can join the effort :)

as for the auth library in use are lucia v3, oslo, and arcticjs i presume would be necessary too for oauth2 / oidc.

my main problem is that authelia itself is not directly listed in the examples, and i never used it, so i don't know wht to expect from said SSO, but is it interchangeable with keycloak? am i misunderstanding something?

if that would be the case i can implement keycloak flow i suppose "easily enough"

i suggest the copenaghen book by pilcrow (lucia author)

[urania-dev]

https://oslo.js.org/reference/oauth2/

[IvanLi-CN]

I'm glad to hear you mention Keycloak. Yes, it and Authelia can indeed be used interchangeably as OIDC Providers. The main difference is that Authelia might be a bit stricter in some specific details.

Is this the book you're referring to? It's fantastic! I just flipped through it and realized I might have read parts of it before, but I can't remember anything now. I feel quite embarrassed!

[urania-dev]

Indeed! :)

well i'm actually trying to configure my traefik to mount authelia, let me try 👯

[IvanLi-CN]

I'm ready for a pleasant surprise. 🎉

[urania-dev]

OIDC is up. tested with keycloak, if not working i think i can rearrange some piece to make it more versatile

[urania-dev]

I'm ready for a pleasant surprise. 🎉

did you manage to set it up? :)

[IvanLi-CN]

did you manage to set it up? :)

Sorry for the late reply, please give me some time, I want to verify that there is no arctic solution.
Because I found that if I want to use authelia, I seem to have to write a custom provider separately. I looked at the code you submitted, and it seems that arctic and lucia are not as closely integrated as I thought.
I will try to submit a code today to see if you can accept a more general solution.

[urania-dev]

Sorry didn't meant to pressure, was just curious about authelia

Well i havent found and authelia specific integration but artic and oslo operates as stand alone helpers, they don't look very interconnected by design i think (/s) . The generic oauth2 guide seems promising. Tho

Also, can you share authelia wellknown to understand how It works? I couldnt manage to set it on my homelab

[IvanLi-CN]

I've created a PR to temporarily store my proposed solution: #65 (comment)

For self-hosted applications, I feel it's somewhat time-consuming to write boilerplate code for each new OIDC provider added. I couldn't find documentation in Arctic on how to create a generic OIDC provider, and it doesn't support discovery out of the box. So, I directly used openid-client to create a generic solution.

Ideally, I think we should offer tailored configuration options for common services like GitHub and Google, while using generic configuration for less common providers that support standard OIDC, such as Authelia and KeyCloak. This approach might reduce the effort required for code maintenance.